The present invention relates to a safety switching apparatus for safely shutting down an automated installation in case of a hazardous situation. More specifically, the invention relates to a safety switching apparatus for safe disconnection of an electrical load used in such an installation.
Safety switching apparatuses in terms of the present invention are used to shut-down a technical installation or a technical device completely or partially when this is necessary in order, for example, to prevent the installation or the device causing a danger to operating personnel. The safety switching apparatuses typically have one or more input terminals for connecting one or more signaling devices, such as emergency-off buttons, guard door switches or light barriers. On the output side, the safety switching apparatuses typically have at least one switching element, which can be used to interrupt an electrical power supply path to the installation or the device. Typically the entire safety circuit including the connected signaling devices is monitored for failsafe operation and, if appropriate, a safety disconnection is initiated.
As will be appreciated, the technical complexity of such safety switching apparatuses increases as the respective safety requirements become more stringent. By way of example, a safety switching apparatus in terms of the present invention should be able to shut-down the installation or the device even when the switching element on the output side of the safety switching apparatus has failed. In the case of a relay, for example, the relay contacts may be welded, so that the relay can no longer be opened. A transistor may break down and thus cause a short circuit which prevents interruption of the electrical power supply path to the load. In order to cope with such faults, safety switching apparatuses are generally designed with multiple channel redundancy, so that, for example, in the event of failure of one switching element, a redundant switching element arranged in series can interrupt the electrical power supply path. However, a redundant implementation itself does not ensure fail-safety, unless proper operation of the respective channels is tested from time to time.
German patent application DE 103 25 363 A1 discloses a safety switching apparatus having an evaluation and control unit which carries out regular disconnection tests during operation in order to check whether the switching elements on the output side are still able to interrupt the electrical power supply path to the load. The evaluation and control unit is designed with two-channel redundancy in order to cope with possible faults in the signal processing section of the safety switching apparatus.
Another example of a safety switching apparatus with two-channel redundancy is disclosed by German patent application DE 100 11 211 A1. In this case as well, the evaluation and control unit, which evaluates and monitors the signaling devices on the input side and drives the switching elements, is designed with two-channel redundancy.
The two known safety switching apparatuses are typical examples of implementations which comply with safety requirements in accordance with Category 3 or even Category 4 of European Standard EN 954-1 or similar safety requirements in accordance with ISO 13849-1 or IEC 61508. However, the predominantly redundant design of the known safety switching apparatuses is complex and expensive.
The assignee of the present invention has already marketed an emergency-off switching device under the brand name PNOZ® X1, which switching device has redundant relay contacts connected in series with one another in order to interrupt the electrical power supply path to an external load. Apart from this redundant relay contacts, however, the PNOZ® X1 is a single-channel device without any special diagnostic capabilities. Without additional measures, the PNOZ®X1 is therefore approved only for applications up to Safety Category 2 of European Standard EN 954-1. In addition, the PNOZ® X1 device requires a certain installation space, and it is desirable to reduce this installation space.